xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion

Summary

CVE	CVE-2026-34601
State	PUBLISHED
Assigner	GitHub_M
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-04-02 18:16:31 UTC
Updated	2026-07-21 19:10:00 UTC
Description	xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active XML markup in the serialized output, enabling XML structure injection and downstream business-logic manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and 0.9.9.

Primary CVSS: v3.1 7.5 HIGH from ADP

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.004720000 probability, percentile 0.378560000 (date 2026-07-21)

Problem Types: CWE-91 | CWE-91 CWE-91: XML Injection (aka Blind XPath Injection) | CWE-91 XML Injection (aka Blind XPath Injection)

Version	Source	Type	Score	Severity	Vector
3.1	ADP	CVSS	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`
3.1	[email protected]	Secondary	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`
3.1	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	Secondary	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`
3.1	CNA	DECLARED	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Source	Vendor	Product	Version	Platforms
CNA	Xmldom	Xmldom	affected xmldom <= 0.6.0	Not specified
CNA	Xmldom	Xmldom	affected @xmldom/xmldom < 0.8.12	Not specified
CNA	Xmldom	Xmldom	affected @xmldom/xmldom >= 0.9.0, < 0.9.9	Not specified
ADP	Red Hat	Migration Toolkit For Applications 8	Not specified	Not specified
ADP	Red Hat	Red Hat Build Of Podman Desktop	Not specified	Not specified
ADP	Red Hat	Red Hat Build Of Podman Desktop	Not specified	Not specified
ADP	Red Hat	Red Hat Developer Hub	Not specified	Not specified
ADP	Red Hat	Red Hat Fuse 7	Not specified	Not specified
ADP	Red Hat	Red Hat OpenShift AI RHOAI	Not specified	Not specified
ADP	Red Hat	Red Hat OpenShift Container Platform 4	Not specified	Not specified
ADP	Red Hat	Red Hat OpenShift Dev Spaces	Not specified	Not specified
ADP	Red Hat	Self-service Automation Portal 2	Not specified	Not specified

Reference	Source	Link	Tags
github.com/xmldom/xmldom/commit/2b852e836ab86dbbd6cbaf0537f584dd0b5ac184	[email protected]	github.com
github.com/xmldom/xmldom/releases/tag/0.9.9	[email protected]	github.com
github.com/xmldom/xmldom/releases/tag/0.8.12	[email protected]	github.com
github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp	134c704f-9b21-4f2e-91b3-4a467353bcc0	github.com
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34601.json	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	security.access.redhat.com
access.redhat.com/security/cve/CVE-2026-34601	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	access.redhat.com
bugzilla.redhat.com/show_bug.cgi	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	bugzilla.redhat.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Source	Time	Event
ADP	2026-04-02T19:03:40.667Z	Reported to Red Hat.
ADP	2026-04-02T17:47:13.209Z	Made public.

There are currently no legacy QID mappings associated with this CVE.